GOLDMAN SACHS GROUP INC

Operational risk is the risk of an adverse outcome resulting from inadequate or failed internal processes, people, systems or from external events. Our exposure to operational risk arises from routine processing errors, as well as extraordinary incidents, such as major systems failures or legal and regulatory matters, that could occur for us or our third-party vendors.

Potential types of loss events related to internal and external operational risk include:

•Execution, delivery and process management;

•Business disruption and system failures;

•Employment practices and workplace safety;

•Clients, products and business practices;

•Third-party risk, including vendor risk;

•Damage to physical assets;

•Internal fraud; and

•External fraud.

Operational Risk, which is part of our second line of defense and reports to our chief risk officer, has primary responsibility for developing and implementing a formalized framework for independently assessing, monitoring and managing operational risk to support firmwide review and challenge of our global businesses, with the goal of maintaining our exposure to operational risk at levels that are within our risk appetite.

Operational Risk Management Process

Our process for managing operational risk includes the critical components of our risk management framework described in the “Overview and Structure of Risk Management,” including a comprehensive data collection process, as well as firmwide policies and procedures, for operational risk events.

We combine top-down and bottom-up approaches to manage and measure operational risk. From a top-down perspective, our senior management assesses firmwide and business-level operational risk profiles. From a bottom-up perspective, our first and second lines of defense are responsible for risk identification and risk management on a day-to-day basis, including escalating operational risks and risk events to senior management.

We seek to maintain a comprehensive control framework designed to provide a well-controlled environment to minimize operational risks. The Firmwide Compliance and Operational Risk Committee is responsible for overseeing compliance and operational risk for our business.

Our operational risk management framework is designed to comply with the operational risk measurement rules under the Capital Framework and has evolved based on the changing needs of our businesses and regulatory guidance.

We have established policies that require all employees and consultants to report and escalate operational risk events. When operational risk events are identified, our policies require that the events be documented and analyzed to determine whether changes are required in our systems and/or processes to further mitigate the risk of future events.

Our operational risk management framework has underlying processes and applications to capture, analyze, aggregate and report operational risk event data and key metrics. A key process within our operational risk management framework is the risk and control self-assessment (RCSA). This process consists of the identification and assessment of operational risks, on a forward-looking basis, taking into consideration the effectiveness of related key controls. The results from this process are analyzed to evaluate operational risk exposures and identify businesses, activities or products with heightened levels of operational risk.

Risk Measurement

We measure our operational risk exposure using both statistical modeling and scenario analyses, which involve qualitative and quantitative assessments of internal and external operational risk event data and internal control factors for each of our businesses. Operational risk measurement also incorporates an assessment of business environment factors, including:

•Evaluations of the complexity of our business activities;

•The degree of automation in our processes;

•New activity information;

•The legal and regulatory environment; and

•Changes in the markets for our products and services, including the diversity and sophistication of our customers and counterparties.

The results from these scenario analyses are used to monitor changes in operational risk and to determine business lines that may have heightened exposure to operational risk. We also perform firmwide stress tests. See “Overview and Structure of Risk Management” for information about firmwide stress tests.

Types of Operational Risks

Increased reliance on technology and third-party relationships has resulted in increased operational risks, such as third-party risk, business resilience risk and cybersecurity risk. See “Cybersecurity Risk Management” for information about our cybersecurity risk management process. We manage third-party and business resilience risks as follows:

Third-Party Risk. Third-party risk, including vendor risk, is the risk of an adverse impact due to reliance on third parties performing services or activities on our behalf. These risks may include legal, regulatory, information security, cybersecurity, reputational, operational or other risks inherent in engaging a third party. We identify, manage and report key third-party risks and conduct due diligence across multiple risk domains, including information security and cybersecurity, resilience and additional supply chain dependencies. We evaluate whether vendors design, implement, and maintain information security controls consistent with our security policies and standards. Vendors that access and process our information on their infrastructure external to our network are required to undergo an initial risk assessment, resulting in the assignment of a vendor inherent risk rating that is determined based on a number of factors, including the type of data stored and processed by a particular vendor. Subsequently, we conduct re-certifications at a depth and frequency that is commensurate with each vendor’s inherent risk rating as a component of our risk-based approach to vendor oversight. Vendors are required to agree to standard contractual provisions before receiving sensitive information from us. These provisions have specific information security control requirements, which apply to vendors that store, access, transmit or otherwise process sensitive information on our behalf. The Third-Party Risk Program monitors, reviews and reassesses third-party risks on an ongoing basis. See “Risk Factors” in Part I, Item 1A of the 2025 Form 10-K for further information about third-party risk.

Business Resilience Risk. Business resilience risk is the risk of disruption to our critical processes. We monitor threats and assess risks and seek to ensure our state of readiness in the event of a significant operational disruption to the normal operations of our critical functions or their dependencies, such as critical facilities, systems, third parties, data and/or personnel. Our resilience framework defines the fundamental principles for business continuity planning (BCP) and crisis management to ensure that critical functions can continue to operate in the event of a disruption. We seek to maintain a business continuity program that is comprehensive, consistent on a firmwide basis, and up-to-date, incorporating new information, including resilience capabilities. Our resilience assurance program encompasses testing of response and recovery strategies on a regular basis with the objective of minimizing and preventing significant operational disruptions. See “Business — Business Continuity and Information Security” in Part I, Item 1 of the 2025 Form 10-K for further information about business continuity.